Apparatus and system for aggregating captured network traffic

ABSTRACT

Methods, systems, computer-readable media, and devices for aggregating sets of received captured network traffic by a network captured traffic distribution device communicatively coupled to a plurality of network captured network traffic distribution devices arranged in a stacked topology are described. Systems for aggregating captured network traffic may include a source of captured network traffic, a plurality of stacked network captured traffic distribution devices arranged in a stacked topology such that each network captured traffic distribution device is communicatively coupled via a communication link with at least one additional stacked network captured traffic distribution device, and an external device. In some embodiments, one or more of the stacked network captured traffic distribution devices, source, and/or external device may operate at locations that are geographically disperse from one another.

RELATED APPLICATIONS

This application is a NONPROVISIONAL of, claims priority to andincorporates by reference U.S. Provisional Patent Application61/248,837, filed 5 Oct. 2009.

FIELD OF THE INVENTION

The present invention relates to aggregation of received capturednetwork traffic by a network captured traffic distribution devicecommunicatively coupled to a plurality of network captured networktraffic distribution devices arranged in a stacked topology.

BACKGROUND

Traditionally, network traffic is captured locally using a mirror portpresent on a network switch or a network tap in conjunction with aninline traffic capture point positioned along a communication linkcoupling two or more communicating devices. Network traffic captured inthis way is typically monitored locally, thus requiring a port on amonitor for every individual capture point and mirror port in thenetwork. This localization leads to great infrastructure and bandwidthcosts and, consequently, many networks are inadequately monitored.

Another drawback to traditional network monitoring systems is that allcaptured traffic is sent to each monitoring device. With increasedspecialization, many conventional monitoring devices monitor a specificcategory or range of categories of network traffic. Thus, when amonitoring device receives all captured traffic, it is inundated with anexcess of information, only a portion of which is useful. This resultsin an inefficient use of both bandwidth and monitoring capacity because,as a first step to monitoring the captured traffic, the monitor mustfirst filter, or otherwise manipulate, the traffic to remove unnecessaryinformation.

A further drawback to traditional network monitoring systems is thatconventional taps do not communicate with one another. Thus, each tapmust be individually configured. In the event of a desired change in theconfiguration information, each tap must then be individuallyreconfigured.

SUMMARY OF THE INVENTION

Methods, systems, computer-readable media, and devices for aggregatingreceived captured network traffic by a network captured trafficdistribution device communicatively coupled to a plurality of networkcaptured network traffic distribution devices arranged in a stackedtopology are herein provided.

A first set of captured network traffic may be received by the networkcaptured network traffic distribution device via, for example, a trafficcapture device positioned at a traffic capture point located between twocommunication nodes and a mirror port of a network switch. A targetdestination of the first set of captured network traffic may bedetermined. Exemplary target destinations include a monitoring device, aprotocol analyzer, a flight recorder, an intrusion detection system, amedia analyzer, a signaling analyzer, a web analyzer, a databaseanalyzer, a voice signaling analyzer, an Internet protocol television(IPTV) analyzer, an application analyzer, a voice analyzer, and aforensic analyzer.

A route for the transmission of the first set of captured networktraffic from the network captured network traffic distribution device,through the stacked topology, to the target destination may then bedetermined. The route may be determined, for example, dynamically afterthe first set of captured network traffic is received, pre-calculatedprior to receipt of the first set of captured network traffic, and/or acombination thereof.

A second set of captured network traffic may be received by the networkcaptured network traffic distribution device via, for example, a trafficcapture device positioned at a traffic capture point located between twocommunication nodes and a mirror port of a network switch. The first andsecond sets of captured network traffic may be received from the same ordifferent sources. When the first and second sets of captured networktraffic are received from different sources, the different sources maybe positioned in geographically disperse locations.

A target destination of the second set of captured network traffic maybe determined. It may then be determined whether the first and secondsets of captured network traffic have the same target destination. Thefirst and second sets of captured network traffic may be aggregatedbased on the determination that the first and second sets of capturednetwork traffic have the same target destination. The aggregated firstand second sets of captured network traffic may then be transmittedtoward the target destination via the determined route.

Methods, systems, computer-readable media, and devices for aggregatingcaptured network traffic received from a plurality of geographicallydisperse sources by a network captured traffic distribution devicecommunicatively coupled to a plurality of network captured networktraffic distribution devices arranged in a stacked topology are hereindescribed.

A plurality of sets of captured network traffic may be received from aplurality of geographically disperse sources at a network capturedtraffic distribution device communicatively coupled to a plurality ofnetwork captured network traffic distribution devices arranged in astacked topology. Exemplary sources include a traffic capture devicepositioned at a traffic capture point located between two communicationnodes and a mirror port of a network switch.

A target destination of each set of received captured network trafficmay be determined. Exemplary target destinations include a monitoringdevice, a protocol analyzer, a flight recorder, an intrusion detectionsystem, a media analyzer, a signaling analyzer, a web analyzer, adatabase analyzer, a voice signaling analyzer, an Internet protocoltelevision (IPTV) analyzer, an application analyzer, a voice analyzer,and a forensic analyzer.

It may then be determined whether any of the sets of received capturednetwork traffic have the same target destination. The sets of capturednetwork traffic with the same target destination may be aggregated basedon the determination. The aggregated captured network traffic may thenbe transmitted toward the target destination via the determined route.

Systems for aggregating captured network traffic are also provided. Anexemplary system includes a source of captured network traffic, aplurality of stacked network captured traffic distribution devicesarranged in a stacked topology such that each network captured trafficdistribution device is communicatively coupled via a communication linkwith at least one additional stacked network captured trafficdistribution device, and an external device.

The stacked topology may be arranged as, for example, a ring topology, amesh topology, a star topology, a topology of single links, a topologyof multiple links, a topology including one or more redundant links, andsome combination thereof. Exemplary communication links include anEthernet cable, a coaxial cable, a fiber optic cable, and a wirelesslink and, in some cases, communication along a communication link isbi-directional. The source, network captured traffic distributiondevices, and/or external device may be compatible with communicationlinks such as, for example, of a 10/100 Ethernet cable, a 1 gigabitEthernet cable, a 10 gigabit Ethernet cable, a copper cable, and/or afiber cable.

The source of captured network traffic may be enabled to, for example,capture network traffic transmitted between two devices or may capturenetwork traffic via as mirror port on a network switch.

Each stacked network captured traffic distribution device included inthe plurality of network captured traffic distribution devices may beconfigured to automatically exchange configuration information with atleast one additional stacked network captured traffic distributiondevices included in the stacked topology and aggregate captured networktraffic with the same target destination. At least one network capturedtraffic distribution device of the plurality of network captured trafficdistribution devices may configured to receive captured network trafficfrom the source. At least one network captured traffic distributiondevice of the plurality of network captured traffic distribution devicesmay be configured to transmit received captured traffic to an externaldevice via a communication link.

In one embodiment, a network captured traffic distribution devicesincluded in the plurality may be further configured to determine atarget destination for received captured network traffic, pre-calculateat least one route for the transmission of received captured networktraffic from an origin through the stacked topology to a targetdestination, determine an optimum route for the transmission of capturednetwork traffic from an origin through the stacked topology to a targetdestination, load balance a distribution of received captured trafficthrough the stacked topology, load spread a distribution of receivedcaptured traffic through the stacked topology, grooming receivedcaptured network traffic, filter the received network traffictransmitted through the stacked topology according to a criterion,and/or evaluate a current operating condition of the stacked topology.In another embodiment, a network captured traffic distribution devicemay be configured to tailor the aggregation of received captured trafficfor each external device based on one or more categories of capturednetwork traffic the external device is configured to monitor or analyze.

The external device may be configured to receive captured networktraffic from one or more of the stacked network captured trafficdistribution devices. Exemplary external devices include a communicationdevice, a protocol analyzer, a flight recorder, an intrusion detectionsystem, a media analyzer, a signaling analyzer, a web analyzer, adatabase analyzer, a voice signaling analyzer, an Internet protocoltelevision (IPTV) analyzer, an application analyzer, a voice analyzer, atelecommunications analyzer, and a forensic analyzer. In one embodiment,the system may further include a plurality of external devices. Eachexternal device may be configured to monitor a category of capturednetwork traffic and/or analyze a category of captured network traffic.

In another embodiment, each of the plurality of stacked network capturedtraffic distribution devices may have a unique IP address and the systemmay further include a web browser enabled to communicate with eachstacked network captured traffic distribution device via the unique IPaddress. The communication may include an exchange of aggregationinstructions that enable a receiving network captured trafficdistribution device to aggregate sets of captured network traffic withthe same target destination.

In some embodiments, one or more of the stacked network captured trafficdistribution devices and/or the external device may operate at locationsthat are geographically disperse from one another.

BRIEF DESCRIPTION OF THE DRAWINGS

The present invention is illustrated by way of example, and notlimitation, in the figures of the accompanying drawings in which:

FIG. 1A is a block diagram illustrating an exemplary network capturedtraffic distribution device, in accordance with an embodiment of thepresent invention;

FIG. 1B is a block diagram further illustrating an exemplary networkcaptured traffic distribution device, in accordance with an embodimentof the present invention;

FIG. 2 is a flowchart illustrating an exemplary process for configuringa network captured traffic distribution device to operate within astacked topology, in accordance with an embodiment of the presentinvention;

FIGS. 3A-3C are screenshots illustrating exemplary graphical userinterfaces (GUIs), in accordance with an embodiment of the presentinvention;

FIG. 4 is a flowchart illustrating an exemplary process for stacking twoor more network captured traffic distribution devices in order to form astacked topology, in accordance with an embodiment of the presentinvention;

FIGS. 5A-5E are block diagrams depicting exemplary stacked topologies ofnetwork captured traffic distribution devices, in accordance withembodiments of the present invention;

FIG. 6A is a flowchart illustrating an exemplary process for thetransmission of captured network traffic via a stacked topology, inaccordance with an embodiment of the present invention;

FIG. 6B is a block diagram illustrating an exemplary system forcapturing network traffic, in accordance with an embodiment of thepresent invention;

FIGS. 7A and 7B are block diagrams illustrating exemplary stackedtopologies of network captured traffic distribution devices configuredas a layer intervening between a communication infrastructure layer andan external device layer, in accordance with an embodiment of thepresent invention;

FIGS. 8A-8C are diagrams illustrating exemplary carrier Ethernet systemsutilizing a stacked topology of network captured traffic distributiondevices, in accordance with an embodiment of the present invention;

FIGS. 9A-9C are diagrams illustrating exemplary carrier VoIP systemsutilizing a stacked topology of network captured traffic distributiondevices, in accordance with an embodiment of the present invention;

FIGS. 10A-10C are diagrams illustrating exemplary IPTV systems utilizinga stacked topology of network captured traffic distribution devices, inaccordance with an embodiment of the present invention;

FIGS. 11A-11C are diagrams illustrating exemplary security systemsutilizing a stacked topology of network captured traffic distributiondevices, in accordance with an embodiment of the present invention;

FIG. 12 is a flowchart illustrating an exemplary process for inserting aVLAN tag into a data packet, in accordance with an embodiment of thepresent invention;

FIGS. 13A and 13B are diagrams illustrating exemplary data packets, inaccordance with an embodiment of the present invention;

FIG. 14 is a flowchart illustrating an exemplary process for determiningan optimum route through a stacked topology of network captured trafficdistribution devices, in accordance with an embodiment of the presentinvention;

FIG. 15 is a flowchart illustrating an exemplary process for determiningan optimum route through a stacked topology of network captured trafficdistribution devices, in accordance with an embodiment of the presentinvention;

FIG. 16 is a block diagram illustrating an exemplary stacked topology ofnetwork captured traffic distribution devices, in accordance with anembodiment of the present invention;

FIG. 17 is a flowchart illustrating an exemplary process for filteringcaptured network traffic, in accordance with an embodiment of thepresent invention;

FIG. 18 is a flowchart illustrating a process for filtering andaggregating captured network traffic, in accordance with an embodimentof the present invention;

FIG. 19 is a flowchart illustrating an exemplary process for aggregatingcaptured network traffic, in accordance with an embodiment of thepresent invention;

FIG. 20 is a flowchart illustrating an exemplary process for aggregatingcaptured network traffic, in accordance with an embodiment of thepresent invention;

FIGS. 21A and 21B are flowcharts illustrating exemplary processes formonitoring a stacked topology of network captured traffic distributiondevices, in accordance with an embodiment of the present invention; and

FIG. 22 is a flowchart depicting an exemplary process for exchangingconfiguration information between two or more network captured trafficdistribution devices included in a stacked topology, in accordance withan embodiment of the present invention.

DETAILED DESCRIPTION I. Device

FIG. 1A is a block diagram illustrating an exemplary network capturedtraffic distribution device 100. Network capture traffic distributiondevice 100 may include a plurality of bidirectional ports 110, aplurality of egress ports 120, a plurality of stacking 130 ports, amanagement port 140, and a power input 150.

Bidirectional ports 110 may be connected, via a communication link, toone or more sources of captured network traffic and may be compatiblewith, for example, a 10/100 Ethernet cable, a 1 gigabit (Gb) Ethernetcable, a 10 Gb Ethernet cable, a copper cable, a fiber optic cableand/or any combination thereof. Egress port 120 may be coupled to one ormore external devices such as a monitoring device, a network analyzingdevice, a communication device, a protocol analyzer, a flight recorder,an intrusion detection system, a media analyzer, a signaling analyzer, aweb analyzer, a database analyzer, a voice signaling analyzer, anInternet protocol television (IPTV) analyzer, an application analyzer, avoice analyzer, a telecommunications analyzer, and a forensic analyzervia a communication link such as a 10/100 Ethernet cable, a 1 GbEthernet cable, a 10 Gb Ethernet cable, a copper cable, a fiber opticcable and/or any combination thereof. On some occasions, one or moreegress ports 120 may be configured as a monitor port or network analyzerport such that it is compatible with, for example, one or more externalnetwork monitor or analysis devices. In some cases, informationassociated with bidirectional ports 110 and/or egress ports 120 may beprovided to a user and/or administrator via a user interface such as agraphic user interface (GUI) as discussed below with regard to FIGS.3A-3C and/or an Internet browser.

Stacking ports 130 may enable the stacking of network captured trafficdistribution device 100 with one or more additional network capturedtraffic distribution devices arranged in a stacked topology. Stacking anetwork captured traffic distribution device may include, but is notlimited to, an exchange of data and configuration information betweentwo or more communicatively coupled, or stacked, network capturedtraffic distribution devices. Stacking port 130 may be compatible with,for example, a 10/100 Ethernet cable, a 1 Gb Ethernet cable, a 10 GbEthernet cable, a copper cable, a fiber optic cable, and/or anycombination thereof. In some embodiments, stacking ports 130 may besimilar to egress ports 120.

Power input 150 may be any appropriate device via which electrical powermay be supplied to network captured traffic distribution device 100 suchas, but not limited to, an electric plug or an electric cable that maybe coupled to a conventional electric wall outlet.

Network captured traffic distribution device 100 may be coupled to oneor more networks such as a telecommunications network, a carrierEthernet network, a voice over Internet protocol (VoIP) network, theInternet, a local area network (LAN), and/or a wireless LAN (WLAN) viaone or more bidirectional ports 110 and/or egress ports 120.

Management port 140 may be coupled directly and/or indirectly to a userand/or administrator (i.e., a device accessible to/employed by such anindividual) of network captured traffic distribution device 100 and/or astacked topology of which network captured traffic distribution device100 is a member. Instructions and/or information may be received bynetwork captured traffic distribution device 100 via management port140. Additionally or alternatively, configuration information associatedwith network captured traffic distribution device 100 and/or one or morefunctions performed by network captured traffic distribution device 100may be accessed or managed via a graphical user interface (GUI) such asGUI 300, 301 and/or 302 as discussed below with regard to FIGS. 3Athrough 3C.

FIG. 1B is a block diagram of a network captured traffic distributiondevice 100 configured in accordance with an embodiment of the presentinvention. Network captured traffic distribution device 100 includesbidirectional ports 110, management port 140, egress ports 120, stackingports 130 and power input 150. Bidirectional ports 110 may be connectedto an application specific integrated circuit (ASIC) 160. ASIC 160 maybe configured to distribute captured network traffic through networkcaptured traffic distribution device 100. In some embodiments, ASIC 160may be one or more analog or electric field effect transistor switches.ASIC 160 may further be configured to perform one or more switchingfunctions thereby facilitating the switching and/or distribution ofcaptured network traffic through network captured traffic distributiondevice 100 and/or the echoing of captured network traffic via one ormore bidirectional ports 110. ASIC 160 may be coupled to a processor170. Processor 170 may be any appropriate computer-processing device ordevices such as a microprocessor, digital signal processor or similardevice.

Processor 170 may be configured (e.g., under the control of suitablecomputer-executable instructions) to manage the distribution of receivedcaptured network traffic through the network captured trafficdistribution device 100 and may be coupled to one or more data storagedevices or memories 180. Distribution management executed by processor170 may include, for example, the management of a flow of receivedcaptured traffic through network captured traffic distribution device100 and/or a stacked topology that includes network captured trafficdistribution device 100. Optionally, the distribution management mayinclude, for example, determining a target destination for receivedcaptured network traffic; pre-calculating at least one route for thetransmission of received captured network traffic from network capturedtraffic distribution device 100, through the stacked topology, to atarget destination; determining an optimum route for the transmission ofcaptured network traffic from network captured traffic distributiondevice 100, through the stacked topology, to a target destination; loadbalancing a distribution of received captured traffic through networkcaptured traffic distribution device 100 and/or the stacked topology,load spreading a distribution of received captured traffic throughnetwork captured traffic distribution device 100 and/or the stackedtopology and evaluating the current operating conditions of the stackedtopology.

In some cases, processor 170 may also be configured to groom receivedcaptured traffic. Grooming received captured traffic may include, forexample, filtering received captured network traffic transmitted throughnetwork captured traffic distribution device 100 and/or the stackedtopology according to one or more criteria, aggregating receivedcaptured network traffic with the same target destination, and modifyingthe content of one or more data packets included in the receivedcaptured traffic. Exemplary modification of the content of a data packetinclude adding data to the data packet, subtracting data from the datapacket, truncating the data packet, and modifying data included in thedata packet.

The processor 170 may further be configured to enable peer-to-peercommunication and/or peer-to-peer management between network capturedtraffic distribution device 100 and an additional stacked networkcaptured traffic distribution device included in a stacked topology. Insome instances, processor 170 may be enabled to manage the distributionof received captured network traffic through a stacked topology ofnetwork captured traffic distribution devices.

Memory 180 may be coupled, directly or indirectly, to processor 170and/or ASIC 160 and may store one or more instructions executable byprocessor 170 and/or ASIC 160. Memory 180 may be configured to store anInternet protocol (IP) address assigned to network captured trafficdistribution device 100. In some embodiments, the IP address assigned tonetwork captured traffic distribution device 100 may be unique for eachindividual network captured traffic distribution device present in astacked topology. Memory 180 may further store, for example,configuration information associated with network captured trafficdistribution device 100, data regarding captured network trafficreceived by network captured traffic distribution device 100, and thedistribution and/or management of received captured network traffic bynetwork captured traffic distribution device 100.

One or more stacking ports 130 may be configured to enable networkcaptured traffic distribution device 100 to be stacked and/orcommunicatively coupled to at least one additional network capturedtraffic distribution device in a stacked topology. Exemplaryconfigurations for stacked topologies include, but are not limited to, aring topology, a mesh topology, a star topology, a topology of singlelinks, a topology of multiple links, a topology including one or moreredundant links, and/or any combination thereof. In some cases, stackingports 130 may be configured as a monitoring port and may be compatiblewith one or more external devices.

When two or more network captured traffic distribution devices 100 arecommunicatively coupled, or stacked, in a topology, configurationinformation resident in one or more of network captured trafficdistribution devices 100 may be exchanged between the two or morenetwork captured traffic distribution devices 100. Exemplaryconfiguration information may relate to, for example, the operation ofthe network captured traffic distribution device, the stacked topology,and/or a device or network coupled to the network captured trafficdistribution device. For example, configuration information may includeoperational statistics associated with network captured trafficdistribution device 100 such as an available ingress or egresstransmission speed, a number of ports available, a level of congestionfor ingressing or egressing traffic, and an indicator of whether networkcaptured traffic distribution device 100 is fully or partiallyoperational.

Optionally, configuration information may also include instructionsregarding the determination of a target destination, such as an externaldevice and/or an egress port resident in the network captured trafficdistribution device for captured network traffic. On some occasions,configuration may relate to the pre-calculation of at least one routefor the transmission of received captured network traffic from alocation, such as a source of network captured network traffic, networkcaptured traffic distribution device 100, or a port resident in networkcaptured traffic distribution device 100, through the stacked topology,to a target destination or the retrieval of one or more pre-calculatedroutes from a data source such as memory 180 or an external device.

Configuration information may also relate to the determining an optimumroute for the transmission of captured network traffic through thestacked topology to a target destination, load balancing a distributionof received captured traffic through the network captured trafficdistribution device and/or stacked topology, load spreading adistribution of received captured traffic through the network capturedtraffic distribution device and/or stacked topology, grooming receivedcaptured traffic according to one or more criterion, filtering receivedcaptured network traffic according to one or more criterion, aggregatingthe received captured network traffic according to one or morecriterion, and evaluating current operating conditions of the stackedtopology and/or devices coupled to the stacked topology.

FIG. 2 is a flowchart illustrating an exemplary process 200 for theconfiguration of one or more ports resident in a stackable networkcaptured traffic distribution device, such as network captured trafficdistribution device 100, as a stacking port. Execution of process 200may enable the stacking of the network captured traffic distributiondevice with one or more additional network captured traffic distributiondevices. Process 200 may be executed by any of the systems and/ordevices described herein and may be executed via, for example, a commandline interface, a GUI like GUIs 300-302 as discussed below withreference to FIGS. 3A-3C, and/or instructions provided via, for example,management port 140 a GUI.

In step 205, access to one or more ports of the network captured trafficdistribution device may be provided to a user and/or administrator,wherein at least one of the ports is a stacking port. Access may beprovided via, for example, physical access to the ports, a processorresident in the network captured traffic distribution device, likeprocessor 170, a management port, like management port 140 and/or adisplay device such as video monitor and/or a computer monitor. Accessto the one or more ports may be facilitated by a network, such as a LAN,a WLAN, or the Internet. In Internet applications, access to the one ormore ports may be facilitated by via an Internet browser using, forexample, a unique IP address associated with the network capturedtraffic distribution device. In some cases, access to the ports may beprovided via an interactive list displayed on a GUI, such as GUI 300-302as discussed below with regard to FIGS. 3A-3C.

Then, in step 210, a selection of a port to be configured as a stackableport may be received. This selection may be received from a user and/oradministrator via the medium by which access to the ports is provided.Such a selection may be made by, for example, physically connecting aport to a communication link and/or additional network captured trafficdistribution device or selecting a port provided via a GUI. In somecases, process 200 may also include receiving an instruction toassociate a function with at least one port of the network capturedtraffic distribution device and associating the selected function withthe at least one port according to the received instruction.

Next, in step 215, the selected port may be configured as a stackingport. Step 215 may be executed by the network captured trafficdistribution device. Then, in step 220, communication between theconfigured stacking port and a stacking port resident on an additionalnetwork captured traffic distribution device may be enabled. This may beenabled by, for example, the turning on of the communication, and/or thecompletion of a physical coupling between the two network capturedtraffic distribution devices and/or the selection or finalization of aselection by a user when selecting a port to be configured as astackable port via, for example, a GUI. Once communication between thetwo stacking ports is established, the network captured trafficdistribution device forms a stacked topology with the additional networkcaptured traffic distribution device or becomes a member of an existingstacked topology including the additional network captured trafficdistribution device. Following step 220, process 200 may end.

FIGS. 3A through 3C are screenshots of exemplary GUIs 300-302 that maybe used to stack, or communicatively couple, two or more networkcaptured traffic distribution device like network captured trafficdistribution device 100 in a stacked topology, and/or add the networkcaptured traffic distribution device to an existing stacked topology. Insome embodiments, GUIs 300-302 may be used to facilitate (e.g., throughmanipulation of the graphical elements rendered therein or provision ofinformation therethrough) any of the processes described herein.

FIG. 3A illustrates an exemplary GUI 300 that includes a status summaryfor three network captured traffic distribution devices like networkcaptured traffic distribution device 100 that are included in a stackedtopology. At the top of GUI 300 is a dialog box 305 indicating anexemplary IP address for one of the network captured trafficdistribution devices included in the stacked topology. Window 310includes information relevant to the stacked topology such as aninteractive menu 315 of options and/or functions available via GUI 300and an interactive list 320 of network captured traffic distributiondevices included in the stacked topology.

Interactive menu 315 may include multiple options relating to use of GUI300 such that selection of a menu item displayed in interactive menu 315may initiate the display of various additional GUIs relating to theselected menu option. Exemplary options included in interactive menu 315relate to the status of a network topology, the settings of a networktopology including, but not limited, to system settings, port settings,simple network management protocol (SNMP) settings, access controlsettings, filter settings, a filter library, an option to save settingsand an option to load setting. Interactive menu 315 may also includeselectable options relating to technical assistance or support, such ashelp software, available to a user of the network captured trafficdistribution device and a link to contact a support service for thenetwork captured traffic distribution device. Interactive menu 315 mayalso include an option for a user and/or administrator to log in and/orlog out of GUI 300, the network captured traffic distribution device,and/or the stacked topology and may also include model and/or softwareidentifying information relevant to the network captured trafficdistribution device.

Interactive list 320 may include one or more boxes or windows ofinformation relating to one or more network captured trafficdistribution devices included in the stacked topology. For example,interactive list 320 includes a listing of information related to anetwork captured traffic distribution device 1 which indicates that portM1 connects network captured traffic distribution device 1 to networkcaptured traffic distribution device 2 325. Likewise, similarinformation is displayed for network captured traffic distributiondevices 2 and 3.

FIG. 3B illustrates an exemplary GUI 301 that includes selectableoptions that enable access to port settings for a selected networkcaptured traffic distribution device. GUI 301 includes dialog box 305indicating an exemplary IP address for one of the network capturedtraffic distribution devices included in the stacked topology andinteractive menu 315.

GUI 301 further includes and a window 340 displaying a list ofselectable tabs 345 relating to ingress or bidirectional ports, likebidirectional ports 110 associated with a network captured trafficdistribution device and a list of selectable tabs 350 relating to egressand/or monitoring ports, like egress ports 120 associated with thenetwork captured traffic distribution device. By selecting one of thetabs provided in lists 345 and/or 350 a user may access informationrelated to the port associated with the selected tab. This informationmay include, for example, an ingressing and/or egressing port speed,port identifying information, a port type, a port class and a selectablestacking option 355 which may enable the port to be configured as eithera monitor port or a stacking port. For example, when port M1 is selectedfrom list 350, information associated with port M1 is displayed inwindow 340. Window 340 may further include a save button 360 that, whenselected, initiates the saving of any changes to the configuration ofthe port.

FIG. 3C is a screenshot of an exemplary GUI 302 showing an interactivelist of ports available on a network captured traffic distributiondevice and an interactive list of functions that may be associated withone or more ports provided in the interactive list of ports. GUI 302 mayinclude interactive menu 315, a list of available filters 380, a list385 of bidirectional ports, a list 390 of egress/monitor ports and aplurality of delete options 395.

Exemplary filter list 380 may include one or more drop down boxes thatmay include various selectable filtering options, such as a filter forHTTP traffic, telnet traffic, and/or non-match received capturedtraffic. Additional functions that may be included in filter list 380and/or on a separate selectable list provided via GUI 302 include, butare not limited to, determining a target destination for receivedcaptured traffic, pre-calculating a route for the transmission ofreceived captured traffic from the network captured traffic distributiondevice, through the stacked topology, to a target destination,determining an optimum route, load balancing a distribution of receivedcaptured traffic through the stacked topology, load spreading adistribution of received captured traffic through the stacked topology,grooming the received captured traffic according to one or morecriteria, filtering the received captured traffic, and aggregatingreceived captured traffic transmitted through the stacked topology.

Bidirectional port list 385 may include selectable options for one ormore bidirectional ports included in the network captured trafficdistribution device and egress/monitor port list 390 may include a listof egress/monitor ports included in the network captured trafficdistribution device and/or an additional network captured trafficdistribution devices available or connected to network topology.Selection of a delete option 395 may initiate the deletion of one ormore selectable options available via GUI 302.

II. Stacked Topology

FIG. 4 is a flowchart illustrating an exemplary process 400 forestablishing or setting up a stacked topology of two or more networkcaptured traffic distribution devices, like network captured trafficdistribution device 100 and/or adding a network captured trafficdistribution device to an existing stacked topology. Process 400 may beexecuted by any of the systems and/or devices described herein.

In step 405, instructions to enable the stacking of a first and secondnetwork captured traffic distribution device may be received by, forexample, a first network captured traffic distribution device, such asnetwork captured traffic distribution device 100, or a processor, suchas processor 170. The instructions of step 405 may be received from, forexample, a user or administrator via, for example, a GUI such as GUIs300, 301 and/or 302, a memory in communication with the processor, suchas memory 180, and/or a physical link between the first and secondnetwork captured traffic distribution devices.

Then, in step 410, the first and second network captured trafficdistribution devices may be stacked and/or communicatively coupledaccording to the instructions received in step 405. The stacking of thefirst and second network captured traffic distribution device may form anew stacked topology or add the first network captured trafficdistribution device to an existing stacked topology including the secondnetwork captured traffic distribution device. Exemplary stacked topologyconfigurations include a ring topology, a mesh topology, a startopology, a topology of single links, a topology of multiple links, atopology including one or more redundant links and/or any combinationthereof.

Next, in step 415, configuration information may be exchanged betweenthe first and second network captured traffic distribution devicesand/or between the first network captured traffic distribution deviceand the stacked topology of network captured traffic distributiondevices. The configuration information exchanged may include, forexample, instructions regarding a determination of a target destinationfor received captured network traffic, a pre-calculation of one or moreroutes for the transmission of received captured network traffic fromthe first network captured traffic distribution device, through thestacked topology, to a target destination, and a determination of anoptimum route for the transmission of received captured network trafficfrom the first network captured traffic distribution device, through thestacked topology, to a target destination.

Exchanged configuration information may also include instructionsregarding the grooming of received captured network traffic. Groomingreceived captured network traffic may include manipulating a trafficflow of received captured traffic and/or a data packet included in thetraffic flow of received captured traffic according to one or moreinstructions or criterion. For example, grooming received networktraffic may include removing unwanted information from one or more datapackets included in the received captured network traffic, truncatingone or more data packets included in the received captured networktraffic, filtering the received captured network traffic according to acriterion, aggregating data packets and/or sets of data packets includedin the received captured network traffic, altering the content of thereceived captured network traffic, modifying a data packet included inthe received captured traffic so that it is compatible with one or moreexternal devices, truncating one or more data packets included in thereceived captured network traffic, adding information to one or moredata packets included in the received captured network traffic, andsubtracting information from one or more data packets included in thereceived captured network traffic.

Exchanged configuration information may further include instructionsregarding load balancing a distribution of the received captured networktraffic through a network captured traffic distribution device and/orstacked topology and load spreading a distribution of the receivedcaptured network traffic through a network captured traffic distributiondevice and/or stacked topology.

Exchanged configuration information may also include informationregarding the capabilities, such as current operating conditions, of thefirst or second network captured traffic distribution device, acommunication link between the first and second network captured trafficdistribution device, and a stacked topology including the second networkcaptured traffic distribution device. For example, exchangedconfiguration information may include information regarding the linkspeed of a port included in the first or second network captured trafficdistribution device or a communication link between the first and secondnetwork captured traffic distribution device, a number of ports includedin the first and/or second network captured traffic distribution device,configuration information associated with a port of the first or secondnetwork captured traffic distribution device, routing information, andinformation regarding a failure or error within the stacked topologyand/or first or second network captured traffic distribution device.

Next, in step 420, one or more routes for the transmission of capturednetwork traffic from the first network captured traffic distributiondevice, through the stacked topology, to a target destination may bedetermined or calculated. Exemplary target destinations include anothernetwork captured traffic distribution device included in the stackedtopology, external devices, monitoring devices, protocol analyzers,flight recorders, intrusion detection systems, media analyzers,signaling analyzers, web analyzers, database analyzers, voice signalinganalyzers, IPTV analyzers, application analyzers, voice analyzers andforensic analyzers. In some embodiments, received captured traffic maybe groomed prior to its transmission toward its target destination.Then, in step 425, at least one optimum route through the stackedtopology may be determined. Further details regarding the determinationof an optimum route are provided below with regard to FIGS. 14 and 15.

Finally in step 430, the received captured network traffic may betransmitted from the first network captured traffic distribution devicetoward a target destination via, for example, the determined optimumroute of step 425. Following step 430, process 400 may end.

FIGS. 5A through 5E are block diagrams illustrating exemplary stackedtopologies of network captured traffic distribution devices, likenetwork captured traffic distribution device 100. FIG. 5A illustrates anexemplary stacked topology 501 of two network captured trafficdistribution devices 100 communicatively coupled, or stacked, via acommunication link 500. Communication link 500 may be wired or wirelessand may be enabled to facilitate communication between the networkcaptured traffic distribution devices 100. For example, communicationlink 500 may be a wireless link capable of transmitting network trafficat a rate of, for example, 1 or 10 Gb/s or a wired link such as a 10/100Ethernet cable, a 1 Gb Ethernet cable, a 10 Gb Ethernet cable, a coppercable, and/or a fiber cable.

FIG. 5B illustrates an exemplary stacked topology 502 of two networkcaptured traffic distribution devices communicatively coupled via twocommunication links 500. In stacked topology 501, communication links500 may link two separate stacking ports resident on each of networkcaptured traffic distribution devices 100 and, on some occasions,communication links 500 may be redundant and/or communication alongcommunication links may be similar or redundant.

FIG. 5C illustrates network captured traffic distribution devices 100arranged in an exemplary complex, or mesh, stacked topology 503.Complex, or mesh, stacked topology 503 includes four network capturedtraffic distribution devices 100 coupled via multiple communicationlinks 500 such that every network captured traffic distribution device100 is communicatively coupled, directly and/or indirectly, to everyother network captured traffic distribution device 100 included instacked topology 503.

FIG. 5D illustrates network an exemplary ring stacked topology 504wherein five network captured traffic distribution devices arecommunicatively coupled to one another in a round-robin or ringconfiguration arrangement via communication links 500.

FIG. 5E illustrates an exemplary star stacked topology 505 wherein fivenetwork captured traffic distribution devices 100 are communicativelycoupled to one another in a star shaped arrangement via communicationlinks 500.

III. Use of Stacked Topology as a Layer Intervening BetweenCommunication Infrastructure and External Device Layers

FIG. 6A illustrates a process 600 for the transmission of capturednetwork traffic via a stacked topology using a layered approach. Process600 may be executed by, for example, any system or device disclosedherein.

In step 1606, captured network traffic may be received by, for example,a network captured traffic distribution device included in a stackedtopology, like network captured traffic distribution device 100. Thecaptured traffic may be received from one or more sources and, in step611, it may be determined whether the source of the received capturednetwork traffic is, for example, an inline traffic capture point, suchas inline captured traffic point 665 or a mirror port, such as mirrorport 660 (see FIG. 6B). When the captured network traffic is receivedvia an inline capture point, the received captured network traffic maybe echoed to a bidirectional port, such as bidirectional port 110, foreventual transition to, for example, a communication device intended toreceive the network traffic prior to its capture (step 616).

Whether the network captured traffic is received via an inline capturepoint or a mirror port, the received captured traffic may be analyzedaccording to, for example, one or more criteria (step 621). The analysisof step 621 may include determining whether a VLAN tag was inserted intoa captured network data packet included in the received captured networktraffic, as discussed below with regard to process 1200 and FIG. 12.Then, in step 626, a target destination of the received captured trafficmay be determined based on, for example, the analysis of step 621. Insome cases, received captured traffic may have multiple targetdestinations such as multiple external devices.

Next, in step 631, one or more routes for the transmission of thereceived captured network traffic from the network captured trafficdistribution device, through the stacked topology, to the targetdestination determined via, for example, step 626 may be determined. Thedetermined routes may then be analyzed (step 636) and an optimum routemay be selected (step 641) based on, for example, the analysis of step636. Further details regarding the analysis of step 636 and theselection of an optimum route (step 641) are provided below in processes1400 and 1500 as discussed with regard to FIGS. 14 and 15.

On some occasions, the received captured traffic may be groomed and/ormodified according to one or more criteria or instructions (step 646).Finally, in step 651, the received and/or groomed captured traffic maybe transmitted from the network captured traffic distribution devicethrough the stacked topology toward the target destination. Followingstep 651, process 600 may end.

FIG. 6B is block diagram depicting a network communication system 600.System 600 may be, for example, any network system capable oftransmitting and/or receiving data packets. In one embodiment, system600 is a telecommunication system such as a Global System for Mobilecommunication (GSM) system or a multi-protocol label switching (MPLS)system. In some embodiments, system 600 may be Gateway General PacketRadio Service (GPRS) system, an Enhanced Data Rates for GSM Evolution(EDGE) system, an Enhanced GPRS (EGPRS) system, an International MobileTelecommunications-2000 (IMT-2000) system, an IMT Single Carrier(IMT-SC) system, an Universal Mobile Telecommunications System (UMTS)system, a Long Term Evolution (LTE) system, a Code Division MultipleAccess (CDMA) system, a system compliant with the IEEE 802.1 Q standardfor configuring virtual LANs (VLAN), or a system enabled to transmitand/or receive data packets including VLAN tags. System 600 may also be,for example, a carrier Ethernet system, an IPTV system, a networksecurity system, and/or a VoIP system.

System 600 may include two or more communication devices 610 coupled toone another via communication links 500. Communication devices 610 maybe any device capable of generating, receiving, transmitting, and/orforwarding network traffic or a data packet, such as data packet 640 to,for example, another communication device 610 and/or a routing device620 via communication link 500. Exemplary communication devices 610include personal computers, mobile computing devices, and mobiletelephones. Data packet 640 may be any type of data packet or amount ofdata transmitted via system 600. Communication device 610 may alsoreceive data packet 640 via communication link 500 from anothercommunication device 610 and/or routing device 620. Routing device 620may be any router enabled to route data packets through communicationsystem 600.

One or more communication devices 610 may be coupled to a networkcaptured traffic distribution device 100 via communication link 500.Exemplary network captured traffic distribution devices 100 includenetwork captured traffic distribution devices, network taps, networkbypass devices, network fail-safe devices, link bypass appliances, andfirewalls.

Network captured traffic distribution device 100 may also becommunicatively coupled so as to provide information to and/or receiveinstructions from a user and/or administrator 655. User/administrator655 may be, for example, a user and/or administrator of system 600and/or network captured traffic distribution device 100.

Network captured traffic distribution device 100 may be communicativelycoupled via communication link 500 to a mirror port 660 present onrouting device 620 and may receive a traffic flow of captured datapackets, including data packet 640, from routing device 620 via mirrorport 660. Network captured traffic distribution device 100 may also becommunicatively coupled to an inline traffic capture point 665 locatedalong a communication link between communication devices 610 and/orbetween communication device 610 and routing device 620. Networkcaptured traffic distribution device 100 may capture data packets, likedata packets 640 and/or receive captured data packets, via inlinenetwork traffic point 665. Network captured traffic distribution device100 may further be coupled an external device 650 via, for example, anegress port. Exemplary external devices 650 include a network monitor, anetwork analyzing device, a communication device, a protocol analyzer, aflight recorder, an intrusion detection system, a media analyzer, asignaling analyzer, a web analyzer, a database analyzer, a voicesignaling analyzer, an Internet protocol television (IPTV) analyzer, anapplication analyzer, a voice analyzer, a telecommunications analyzer,and a forensic analyzer. Network captured traffic distribution device100 may also echo one or more data packets to, for example,communication device 610 and/or external device 650.

FIG. 7A is a block diagram illustrating a layered system 700 includingan exemplary stacked topology of network captured traffic distributiondevices wherein the stacked topology is a layer intervening between alayer of communication infrastructure devices and a layer of externaldevices such as monitoring devices and/or analyzing devices. System 700includes three layers; a communication infrastructure layer 710, acaptured traffic distribution layer 720, and an external device layer730.

Communication infrastructure layer 710 includes a plurality ofcommunication infrastructure device 620, such as routers and switches.One or more communication devices 620 may be communicatively coupledwith one another, and/or one or more network captured trafficdistribution devices 100 as included in the captured trafficdistribution layer 720 via, for example, inline traffic capture point665 or mirror port 660. Captured traffic distribution layer 720 mayinclude multiple network captured traffic distribution devices 100arranged in a stacked topology. Some, or all, network captured trafficdistribution devices 100 may further be communicatively coupled to oneor more large capacity network captured traffic distribution devices705. Large capacity network captured traffic distribution devices 705may be capable of, for example, aggregating captured network trafficreceived from a plurality of network captured traffic distributiondevices 100, filtering captured network traffic received from aplurality of network captured traffic distribution devices 100 and/orgrooming captured traffic received from a plurality of network capturedtraffic distribution devices 100. On some occasions, large capacitynetwork captured traffic distribution device 705 may groom orspecifically tailor the network captured traffic transmitted to anexternal device 650 according to one or more criteria specific to theexternal device 650. One or more large capacity network captured trafficdistribution devices 705 may be communicatively coupled to one or moreexternal devices as provided in external device layer 730.

FIG. 7B is a diagram illustrating an exemplary layered system 701including an exemplary stacked topology of network captured trafficdistribution devices wherein the stacked topology is a layer interveningbetween a layer of communication infrastructure devices and a layer ofexternal devices such as monitoring devices and/or analyzing devices.System 701 includes communication infrastructure layer 710, capturedtraffic distribution layer 720, and external device layer 730. Some orall communication links included in system 701 may include an inlinetraffic capture point 665.

Communication infrastructure layer 710 includes a gateway layer 735, acore layer 740, a distribution layer 745, and an access layer 750.Gateway layer 735 may include, for example, a network cloud 760communicatively coupled to a plurality of firewalls 755 that arecommunicatively coupled via a communication link, like communicationlink 500, to a plurality of communication infrastructure devices 620.Communication infrastructure devices 620 of gateway layer 735 may becommunicatively coupled via a communication link, like communicationlink 500, to a plurality of communication infrastructure devices 620included in core layer 740. Communication infrastructure devices 620 ofcore layer 740 may be communicatively coupled via a communication link,like communication link 500, to a plurality of communicationinfrastructure devices 620 included in distribution layer 745.Communication infrastructure devices 620 of distribution layer 745 maybe communicatively coupled via a communication link, like communicationlink 500, to a plurality of communication infrastructure devices 620included in access layer 750.

One or more communication infrastructure devices 620 of communicationinfrastructure layer 710 may be communicatively coupled via, forexample, a communication link, like communication link 500 or inlinetraffic capture point 665 or a mirror port, like mirror port 660, to oneor more network captured traffic distribution devices 100 included incaptured traffic distribution layer 720. Captured traffic distributionlayer 720 may include a plurality of network captured trafficdistribution devices 100 communicatively coupled to one another orarranged in a stacked topology via communication links 500. Networkcaptured traffic distribution devices 100 may be further coupled tolarge capacity network traffic captured distribution devices 705. Largecapacity network captured traffic distribution devices 705 may becoupled to a central management device 780 via a managementcommunication link 765. Management communication link 765 may be anyappropriate wired or wireless link that enables communication betweenhigh capacity network captured traffic distribution device 705 andcentral management device 780. Exemplary central management devices 780include a computer monitor or computer system as may be managed by auser and/or administrator such as user administrator 655. Large capacitynetwork captured traffic distribution devices 705 may be further coupledto one or more external devices 650 as included in external device layer730.

FIGS. 8A through 8C are diagrams illustrating exemplary carrier Ethernetembodiments of the present invention. FIG. 8A is a diagram illustratinga carrier Ethernet system 801 including a plurality of communicationdevices 610, or structures that support communication devices 610 suchas residences, office buildings and antennas, via which multiple usersare communicatively coupled via a communication link, like communicationlink 500, to one or more communication infrastructure devices 620.Exemplary communication infrastructure devices 620 included in system801 are switches, routers, Ethernet network intrusion devices (NID),edge routers, and optical line termination (OLT) devices 815. Aplurality of communication infrastructure devices 620 of system 801 maybe arranged in a topology, such as a local metro ring, via communicationlinks, like communication links 500.

Communication links between communication infrastructure devices 620and/or between communication infrastructure devices 620 andcommunication devices 610 may be communicatively coupled to a stackedtopology of network captured traffic distribution devices 100 via, forexample, inline traffic capture points 665. The stacked topology ofnetwork captured traffic distribution devices 100 may also be coupled toone or more external devices 650 via communication links, likecommunication links 500.

FIG. 8B is a diagram illustrating a carrier Ethernet system 802 of thepresent invention. In FIG. 8B a plurality of communication devices 610,such as wireless antenna are communicatively coupled to one or morenetwork security devices 810, such as a network forensic security deviceor a network intrusion detection device. Network security devices 810may then be coupled via communication links, like communication links500, to one or communication infrastructure devices 620 arranged in alocal metro ring topology. One or more of communication infrastructuredevices 620 located along the local metro ring may be communicativelycoupled to, for example, a public switched data network (PSDN) 825and/or a radio network controller (RNC) 820 via communication links,like communication links 500. PSDN 825 and RNC 820 may also becommunicatively coupled to one another via communication links, likecommunication links 500. Along these communication links may be one ormore inline traffic capture points 665. Network traffic capture points665 may be communicatively coupled to one or more network capturedtraffic distribution devices 100 arranged in a stacked topology. Networkcaptured traffic distribution devices 100 may also be coupled to largecapacity network captured traffic distribution devices 705 viacommunication links, like communication links 500. Large capacitynetwork captured traffic distribution devices 705 may also becommunicatively coupled to one or more external devices 650.

FIG. 8C is a diagram illustrating a layered carrier Ethernet system 803.Carrier Ethernet system 803 includes five layers; a communication devicelayer 830, communication infrastructure layer 710, a media communicationlayer 835, captured traffic distribution layer 720, and external devicelayer 730. Devices included in the layers of system 803 may becommunicatively coupled via communication links like communication links500. One or more of the communication links in system 803 may includeinline traffic capture point 665.

Communication device layer 830 includes multiple communication devices610, such as a triple play fiber to the home (FTTH)/very high bit rateDSL (VDSL) device, a wireless backhaul antenna, commercial or businessEthernet services.

Communication infrastructure layer 710 may include three layers; anaccess layer 750, IP edge layer 745, and an IP/MPLS core layer 740.Access layer 750 may include multiple communication infrastructuredevices 620, such as routers, PC-MAN routers, and switches that arecommunicatively coupled to communication infrastructure devices 620included in IP edge layer 745. Communication infrastructure devices 620present in IP edge layer 745 may be communicatively coupled to one ormore communication infrastructure devices 620 included in IP/MPLS core740. Communication infrastructure devices 620 included in IP/MPLS core740 may serve to switch and/or route communications to mediacommunication layer 835.

On some occasions, media communication layer 835 may include a IMFsystem and/or an IPTV system. Exemplary IMF systems include a mediagateway controller function (MGCF), a master switch or router, a mediagateway (MGW), a high-speed serial interface (HSS), a central router mayalso be communicatively, and a proxy call session control function(P-CSCF). IPTV system may include a router communicatively coupled to anencryption device. The encryption device may be communicatively coupledto a distribution server, a voice on demand (VoD) server, and/or anaudio voice on demand (VoDA) server. The distribution server and/or theVoD server may also be communicatively coupled to an encoder.

Captured traffic distribution layer 720 may be coupled to one or moredevices included in communication device layer 830, communicationinfrastructure layer 710, and media communication layer 835 via, forexample, inline traffic capture point 665 and/or mirror port 660.Captured traffic distribution layer 720 may include one or more networkcaptured traffic distribution devices 100 arranged in a stacked topologyand central management device 780. One or more of the network capturedtraffic distribution devices 100 may be communicatively coupled to alarge capacity network captured traffic distribution device 705. Largecapacity network captured traffic distribution device may further becoupled to one or more external devices included in external devicelayer 730.

FIG. 9A is a block diagram depicting an exemplary carrier voice over IP(VoIP) system 901. System 901 may include one or more communicationinfrastructure components such as servers 930, firewalls 775,communication infrastructure devices 620, media gateways 910, coredevices 915, EGV devices 920 and/or base stations 925 communicativelycoupled to one another via communication links, like communication links500. One or more communication links may include inline traffic capturepoints 665.

System 901 may further include a plurality of network captured trafficdistribution devices arranged in a stacked topology. One or more of thecomponents of communication layer 710 may be communicatively coupled tonetwork captured traffic distribution device 100 via inline trafficcapture point 665. Network captured traffic distribution devices 100 maybe coupled to one or more large capacity network captured trafficdistribution devices 705 that may be communicatively coupled to one ormore external devices 650. External devices 650 may further be coupledto an application server 935.

FIG. 9B is a block diagram illustrating an exemplary carrier VoIP system902. System 902 includes multiple communication infrastructure devices620, such as service GPRS support node (SGSN) servers, communicativelycoupled to one another 620 via communication links like communicationlinks 500. Communication links between communication infrastructuredevices 620 may include one or more inline traffic capture points 665via which one or more network captured traffic distribution devices suchas network captured traffic distribution devices 100 may receivecaptured traffic. Network captured traffic distribution devices arearranged in a stacked topology and are communicatively coupled to one ormore large capacity network captured traffic distribution devices 705.Large capacity network captured traffic distribution device 705 may becommunicatively coupled to one or more external devices 650.

FIG. 9C is a block diagram illustrating an exemplary carrier VoIP system903. System 903 has four layers; a communicationinfrastructure/communication device layer 710/830, an application layer950, captured traffic distribution layer 720 and external device layer730. Components within communication infrastructure/communication devicelayer 710/830 and application layer 950 may be communicatively coupledvia a media link, shown in FIG. 9C as a dashed line, and/or a signalinglink, shown in FIG. 9C as a bold line, to one another. One or more medialinks and/or signaling links of system 903 may include an inline trafficcapture point 665.

Communication infrastructure layer 710 includes components of a publicswitch telephone network (PSTN) and an IP network. Exemplary PSTNcomponents include communication devices 610, such as a telephone,communicatively coupled to communication infrastructure devices 620 suchas a media gateway (MGW) 955 and a signal transfer point (STN) 965.

Exemplary IP network components include communication devices 610, suchas a telephone or mobile phone, communicatively coupled to an IAB 960 ora network 760. The IP network may also include communicationinfrastructure device 620, such as a switch, router, or edge routercommunicatively coupled to one or more components of application layer950 or PSTN.

Application layer 950 includes communication infrastructure devices likea proxy call session control function (P-CSCF) device 980 that may becoupled to one or more components of IP network via a media and/orsignaling link. Application layer 950 further includes a media gateway920 and a high speed serial interface 975 (HSS). Both HSS 975 and mediagateway 920 may be communicatively coupled to P-CSCF 980. Applicationlayer 950 may be communicatively coupled to a network captured trafficdistribution layer 720 via, for example, one or more inline trafficcapture points 665.

Network captured traffic distribution layer 720 may include one or morenetwork captured traffic distribution devices 100 arranged in a stackedtopology. Network captured traffic distribution devices 100 may becommunicatively coupled to a large capacity network captured trafficdistribution device 705. Captured traffic distribution layer 720 mayfurther include a central management device 780 which may operate tomanage one or more network captured traffic distribution devices 100and/or large capacity network captured traffic distribution devices 705.The devices present in captured traffic distribution layer 720 may becoupled to one or more external devices included in monitoring layer730.

FIG. 10A is a block diagram illustrating an exemplary IPTV system 1001.System 1001 includes multiple communication infrastructure devices 620,such as an insertion server, a key server, and a plurality of VoDservers, communicatively coupled with one another via communicationlinks, like communication link 500. One or more inline traffic capturepoints 665 may be present along the communication links via which thecommunication links are coupled to a stacked topology of networkcaptured traffic distribution devices 100. Captured network traffic maybe received by network captured traffic distribution device 100 viainline traffic capture points 665 or a mirror port like mirror port 660.Network captured traffic distribution devices 100 included in thestacked topology may also be communicatively coupled via communicationlinks, like communication link 500, to one or more large capacitynetwork captured traffic distribution devices 705. Large capacitynetwork captured traffic distribution devices 705 may further be coupledto one or more external devices 650.

FIG. 10B is a block diagram illustrating an exemplary IPTV system 1002.System 1002 includes multiple communication devices 610 communicativelycoupled to one or more communication infrastructure devices 620 viacommunication links, like communication link 500. In system 1002,communication infrastructure devices 620 may be digital subscriber lineaccess multiplexers (DSLAM). Communication links between one or morecommunication devices 610 and/or communication infrastructure devices620 may include inline traffic capture points 665 that arecommunicatively coupled to one or more network captured trafficdistribution devices 100 arranged in a stacked topology. Networkcaptured traffic distribution devices 100 may also be communicativelycoupled to one or more external devices 650.

FIG. 10C is a diagram illustrating an exemplary layered IPTV system1003. System 1003 includes communicating device layer 830, multiplecommunication infrastructure layers 710, captured traffic distributionlayer 720, and external device layer 730. Devices included in the layersof system 1003 may be communicatively coupled via communication linkslike communication links 500. One or more of the communication links insystem 1003 may include inline traffic capture point 665.

Exemplary devices included in communication device layer 705 include oneor more residential communication devices or residential gateways. Oneor more of the communicating devices 610 present in communication devicelayer 830 may be communicatively coupled to one or more communicationinfrastructure devices 620, such as a DSAM router resident in a firstcommunication infrastructure layer, or access layer 710. One or morecommunication infrastructure devices 620 resident in first communicationinfrastructure layer may be communicatively coupled to one or moreadditional communication infrastructure devices 620 resident in a secondcommunication infrastructure layer 710.

Second communication infrastructure layer 710 may include a head endsystem, a distribution system, and a local video office system.Exemplary head end systems include multiple communication infrastructuredevices 620, such as switches, encryption devices, VoD server, adistribution server, and an encoder, communicatively coupled to oneanother. Exemplary distribution systems may include one or morecommunication infrastructure devices 620, such as routers and/orswitches that may be communicatively coupled to the local office videosystem. Exemplary local office video system may include multiplecommunication infrastructure devices 620, such as a switch or routercommunicatively coupled to infrastructure servers, ACS, encryptiondevices, VoD servers, and/or content providers.

One or more of the communication links communicatively coupling thedevices of communication device layer 830 and communicationinfrastructure layer 710 may include an inline traffic capture point 665via which captured network traffic may be communicated to one or morenetwork captured traffic distribution devices 100 arranged in a stackedtopology present in captured traffic distribution layer 720. Networkcaptured traffic distribution devices 100 may also be communicativelycoupled to large capacity network captured traffic distribution device705. Large capacity network captured traffic distribution device 705 mayalso be communicatively coupled to central management device 780 and oneor more external devices present in external device layer 730.

FIG. 11A is a diagram illustrating an exemplary network security system1101. System 1101 includes multiple communication infrastructure devices620, such as switches, communicatively coupled via an active and/orpassive communication link, like communication link 500, to one or morefirewalls 755. Active communication links are depicted in FIG. 11A asbold lines while passive communication links are depicted in FIG. 11A asdotted lines.

One or more network traffic capture points 665 may be located alongactive and/or passive links between communication infrastructure devices620 and firewalls 775 via which captured network traffic may becommunicated to one or more network captured traffic distributiondevices 100 arranged in a stacked topology. Network captured trafficdistribution devices 100 may also be communicatively coupled to one ormore large capacity network captured traffic distribution devices 705which may be communicatively coupled to one or more external devices 650via an active and/or passive communication link.

FIG. 11B is a diagram illustrating an exemplary network security system1102. Network security system 1102 includes a plurality of communicationinfrastructure devices 620, such as routers, switches, applicationgateways, vports, load balancers, secure switches, firewalls 755 andnetworks 760 (e.g., public networks, application server networks,electronic commerce gateway networks, and/or private networks(databases)), in communication with one another via one or morecommunication links, like communication links 500. The communicationlinks may include one or more inline traffic capture points 665 viawhich captured network traffic may be communicated to one or morenetwork captured traffic distribution devices 100 arranged in a stackedtopology. Network captured traffic distribution devices 100 may furtherbe communicatively coupled to one or more large capacity networkcaptured traffic distribution devices 705 which may, in turn, be coupledto one or more external devices 650.

FIG. 11C illustrates an exemplary network security system 1103 includingcommunication infrastructure layer 710, captured traffic distributionlayer 720, and external device layer 730. Exemplary components includedin communication infrastructure layer 710 include communicationinfrastructure devices 620, such as networks 760, firewalls 755,routers, switches, load balancers, etc. One or more components ofcommunication infrastructure 710 may be communicatively coupled to oneor another via a communication link, like communication link 500. Thesecommunication links may include one or more inline traffic capturepoints 665 via which captured network traffic may be communicated to oneor more network captured traffic distribution devices 100 arranged in astacked topology resident in captured traffic distribution layer 720.Network captured traffic distribution devices 100 may be communicativelycoupled to one or more large capacity network captured trafficdistribution devices 705. Captured traffic distribution layer 720 mayfurther include a central management device 780 communicatively coupledto large capacity network captured traffic distribution device 705.Large capacity network captured traffic distribution device 705 mayfurther be coupled to one or more external devices 650.

IV. VLAN Tagging

FIG. 12 is a flow chart illustrating an exemplary process 1200 forinserting a virtual LAN (VLAN) tag into one or more received captureddata packets. Process 1200 may be executed by, for example, any of thedevices and/or systems disclosed herein.

In step 1205, one or more data packets of captured network traffic maybe received by a network captured traffic distribution device includedin a stacked topology, such as network captured traffic distributiondevice 100. The captured data packet may be received from one or moresources and, in step 1210, it may be determined whether the source ofthe received captured data packet is, for example, an inline trafficcapture point, such as inline captured traffic point 665 or a mirrorport, such as mirror port 660. When the captured data packet is receivedvia an inline capture point, the received captured data packet may beechoed to a bidirectional port, such as bidirectional port 110, foreventual transition to, for example, a communication device intended toreceive the captured data packet (step 1215). Whether the captured datapacket was received via an inline traffic capture point or a mirrorport, a target network captured traffic distribution device included inthe stacked topology for the captured data packet may be determined(step 1220).

Then, in step 1225, a VLAN tag may be inserted into the captured datapacket. The VLAN tag may serve to indicate, for example, identifyinginformation associated with the data packet, such as an origin of thedata packet, a target network captured traffic distribution device forthe data packet, data packet size, and data packet type. The insertedVLAN tag may remain in the data packet during its transport throughsuccessive network captured traffic distribution devices included in thestacked topology.

Next, in step 1230, an optimum route for transmission of the captureddata packet from the receiving network captured traffic distributiondevice to the target network captured traffic distribution device may bedetermined. The optimum route for the captured data packet may bedetermined via, for example, process 1400 and/or 1500 as discussed belowwith reference to FIGS. 14 and 15. Then, in step 1235, the captured datapacket may be transmitted to a second network captured trafficdistribution device in the stacked topology along the optimum route. Thedata packet may then be analyzed at the second network captured trafficdistribution device (step 1240) to determine, for example, the targetnetwork captured traffic distribution device of the data packet based onthe inserted VLAN tag (step 1245). Next, in step 1250, it may bedetermined whether the second network captured traffic distributiondevice is the target destination of the captured data packet based on,for example, information included in the VLAN tag inserted at step 1225.When the second network captured traffic distribution device is not thetarget destination, steps 1230 through 1250 may repeat themselves.

When the second network captured traffic distribution device is thetarget network captured traffic distribution device, the VLAN taginserted at step 1225 may be removed (step 1255) by, for example, thesecond network captured traffic distribution device. Finally, at step1260, the captured data packet may be transmitted towards an egress portof the second network captured traffic distribution device via which, insome embodiments, the captured data packet may be transmitted to one ormore external devices. Exemplary external devices include a monitoringdevice, a protocol analyzer, a flight recorder, an intrusion detectionsystem, a media analyzer, a signaling analyzer, a web analyzer, adatabase analyzer, a voice signaling analyzer, an IPTV analyzer, anapplication analyzer, a voice analyzer, a telecommunications analyzer,and a forensic analyzer. Following step 1260, process 1200 may end.

FIG. 13A is a block diagram of an exemplary data packet 1301. Datapacket 1301 includes a header 1305, a payload 1315, and an old framecheck sequence (FCS) and/or cyclic redundancy check (CRC) block 1320. Insome embodiments, data packet 1301 may resemble data packet 640. Header1305 may include, for example, address information and otherinformation, as needed, for the transmission of data packet 1305 througha network communication system, like network communication system 601.Payload 1315 may include any payload or data appropriate for data packet1301. Old FCS/CRC block 1320 may include information necessary forcompliance with one or more system protocols, communication protocols,and/or the routing of data packet 1301 through a network communicationsystem, like network communication system 601.

FIG. 13B illustrates an exemplary modified data packet 1302 includingheader 1305, payload 1315, a VLAN tag 1310, and a new FCS/CRC 1330. Insome cases modified data packet 1302 may be a modified form of datapacket 1301 and/or 640. Modified data packet 1302 may be generated via aprocess for inserting a VLAN tag into a data packet, such as process1200, as discussed above with reference to FIG. 12. Although FIG. 13Bindicates a location of VLAN tag 1310 that is immediately after header1305, VLAN tag 1310 may be inserted into any location within modifieddata packet 1302. New FCS/CRC 1330 may include information indicatingthat data packet 1302 includes a VLAN tag and in some cases may be anupdated version of old FCS/CRC 1320.

V. Optimum Route

FIG. 14 is a flowchart illustrating a process 1400 for determining anoptimum route for the transmission of captured network traffic and/or acaptured data packet included in captured network traffic through astacked topology of two or more network captured traffic distributiondevices. Process 1400 may be executed by, for example, any of thedevices and/or systems disclosed herein.

In step 1405, a traffic flow of captured network traffic may be receivedat, for example, a network captured traffic distribution device includedin a stacked topology, such as network captured traffic distributiondevice 100. The captured traffic may be received from one or moresources of captured traffic. Next, in step 1410 it may be determinedwhether the source of the received captured network traffic is, forexample, an inline traffic capture point, such as inline capturedtraffic point 665 or a mirror port, such as mirror port 660. When thecaptured network traffic is received via an inline capture point, thereceived captured network traffic may be echoed to a bidirectional port,such as bidirectional port 110, for eventual transition to, for example,a communication device and/or external device intended to receive thecaptured network traffic (step 1215).

Whether the captured traffic was received via an inline captured trafficpoint or a mirror port, a target destination of the captured traffic maybe determined (step 1420). Exemplary target destinations of the capturednetwork traffic include a network captured traffic distribution deviceincluded in the stacked topology, a monitoring device, a protocolanalyzer, a flight recorder, an intrusion detection system, a mediaanalyzer, a signaling analyzer, a web analyzer, a database analyzer, avoice signaling analyzer, an IPTV analyzer, an application analyzer, avoice analyzer, a telecommunications analyzer, and a forensic analyzer.

Next, in step 1425 one or more routes, or transmission pathways, fromthe receiving network captured traffic distribution device through thestacked topology to the target destination may be determined. In somecases, a route may be determined in real time or on an as-needed basis.In one embodiment, the determination of step 1425 may include accessingone or more pre-calculated routes for the transmission of receivedcaptured network traffic through the stacked topology to a targetdestination. Pre-calculated routes may be stored at, for example, thenetwork captured traffic distribution device in a memory, such as memory180, accessed via another network captured traffic distribution deviceincluded in the stacked topology and/or accessed from an externalstorage location via, for example, a management port, such as managementport 140 and/or bidirectional port 110. In another embodiment, one ormore routes may be determined via a download or exchange from a webbrowser by the network captured traffic distribution device. In somecases, step 1425 may include accessing previously stored determinedroutes and/or selected optimum routes. Further details regarding thedetermination of step 1425 are discussed below with reference to FIG. 15and process 1500.

In step 1430, the determined and/or pre-calculated routes may beanalyzed according to one or more criterion. In some cases, the analysisof step 1430 may include determining a transmission capacity ortransmission/link speed available for each route and/or segment of aroute determined in step 1420. The analysis may also includedetermining, for each route, the number of network captured trafficdistribution devices in the stacked topology that received captured datapackets will pass through prior to arrival at the target destination.The analysis of step 1430 may further include determining a loadbalanced route through the stacked topology and/or determining a loadspread route through the stacked topology.

In some cases, the analysis of step 1430 may indicate two or moresimilar, or redundant optimum routes through the stacked topology.Redundant optimum routes may be routes through the stacked topology thatare equivalent according to the analysis criteria. In some embodiments,the selection of one similar, or redundant route over another may bemade in light of a load balancing and/or load spreading consideration.

Then, in step 1435, it may be determined whether load balancing for thenetwork captured traffic distribution device is enabled. Whether loadbalancing is enabled or not, it may be further determined in step 1440whether load spreading is enabled. When load spreading is enabled, anoptimum load spread route for received captured network traffic may bedetermined (step 1445). When load spreading is not enabled, thetransmission capacity of possible optimum load balanced routes and/oroptimum load spread routes may be analyzed (step 1455).

When load balancing is enabled in step 1435, an optimum load balancedroute for the received captured network traffic may be determined (step1450). Then the transmission capacity of possible optimum load balancedroutes and/or optimum load spread routes may be analyzed (step 1455).

Next, in step 1460, an optimum route for transmission of the capturednetwork traffic may be selected based upon, for example, the analysis ofstep 1455. Following this selection, the received captured networktraffic may be transmitted toward the target destination via theselected optimum route (step 1455). The target destination may be, forexample, another network captured traffic distribution device includedin the stacked topology or an external device coupled to one or morenetwork captured traffic distribution devices included in the stackedtopology.

Optionally, in step 1465, the determined routes of step 1425 and/or theselected optimum route of step 1460 may be stored in, for example, thenetwork captured traffic distribution device, in a memory, such asmemory 180, and/or may be communicated to one or more network capturedtraffic distribution devices included in the stacked topology or anexternal device.

FIG. 15 is a flowchart illustrating an optional process 1500 or stepsincluded in the analysis of step 1430 as discussed above with regard toFIG. 14. Process 1500 may be executed by, for example, any of thedevices and/or systems disclosed herein.

In step 1505, information regarding some or all data paths available orincluded in a stacked topology may be received by, for example, anetwork captured traffic distribution device, such as network capturedtraffic distribution device 100. The information may be received via,for example, an exchange of configuration information, between thenetwork captured traffic distribution device and an additional networkcaptured traffic distribution device included in the stacked topology ora message from, for example, an additional network captured trafficdistribution device included in the stacked topology, a communicationdevice, or an external device.

Optionally, in step 1510, a link/transmission speed of some or all ofthe communication links and network captured traffic distributiondevices included in the stacked topology and/or communication devicesand external devices coupled to the stacked topology may be determined.Then, in step 1515, a level of congestion for some or all of thecommunication links and network captured traffic distribution devicesincluded in the stacked topology and/or communication devices andexternal devices coupled to the stacked topology may be determined.

Optionally, in step 1520, the number of hops or intervening networkcaptured traffic distribution devices along a route may be determined.Finally, in step 1525, it may be determined whether some or all of thedata paths included in a route are operational. This determination mayinclude a determination of whether a data path is online, transmittingat an optimum link speed, and/or congested.

FIG. 16 is a block diagram illustrating an exemplary mesh network offour network captured traffic distribution devices, such as networkcaptured traffic distribution devices 100. FIG. 16 shows four networkcaptured traffic distribution devices; a network captured trafficdistribution device 100 _(A), a network captured traffic distributiondevice 100 _(B), a network captured traffic distribution device 100_(C), and a network captured traffic distribution device 100 _(D).Network captured traffic distribution devices 100 _(A)-100 _(D) arecommunicatively coupled to one another via one or more communicationlinks 500. For example, network captured traffic distribution device 100_(A) is communicatively coupled to network captured traffic distributiondevice 100 _(B) via two communication links 500 _(A-B-1) and 500_(A-B-2). Network captured traffic distribution device 100 _(A) is alsocommunicatively coupled to network captured traffic distribution device100 _(D) via a communication link 500 _(A-D). Network captured trafficdistribution device 100 _(A) is further connected to network capturedtraffic distribution device 100 _(C) via a communication link 500_(A-C). Network captured traffic distribution device 100 _(B) isconnected to network captured traffic distribution device 100 _(D) via acommunication link 500 _(B-D) and network captured traffic distributiondevice 100 _(C) is communicatively coupled to network captured trafficdistribution device 100 _(D) via a communication link 500 _(C-D).

In cases where the link speed of all communication links 500 pictured inFIG. 16 is the same and traffic received by network captured trafficdistribution device 100 _(A) were to go to network captured trafficdistribution device 100 _(C), then network captured traffic distributiondevice 100 _(A) would determine that communication link 500 _(A-C) wouldbe the optimum route for the transmission of captured network traffic asit is the most direct route between network captured trafficdistribution device 100 _(A) and network captured traffic distributiondevice 100 _(C). In the event that communication link 500 _(A-C) hasfailed or is not operating properly, network captured trafficdistribution device 100 _(A) may then select a new optimum route for thetransmission of captured data packets to network captured trafficdistribution device 100 _(C). Again, given that all communication links500 are transmitting at the same speed, the next optimum route selectedby network captured traffic distribution device 100 _(A) may be viacommunication link 500 _(A-D) to network captured traffic distributiondevice 100 _(D). Once received, the target destination of capturednetwork traffic is determined at network captured traffic distributiondevice 100 _(D) and communication link 500 _(C-D) may be selected bynetwork captured traffic distribution device 100 _(D) for transmissionof the received captured traffic from network captured trafficdistribution device 100 _(D) to network captured traffic distributiondevice 100 _(C).

In a case where the link speed for all communication links 500illustrated in FIG. 16 is not the same and, for example, thetransmission speed of communication link 500 _(A-C) is slower than theremaining links, network captured traffic distribution device 100 _(A)may select communication links 500 _(A-D) and 500 _(C-D) for thetransmission of captured network from network captured trafficdistribution device 100 _(A) to network captured traffic distributiondevice 100 _(B), although it is a longer route through the stackedtopology than the direct link between network captured trafficdistribution devices 100 _(A) and 100 _(C), because it may be faster dueto the higher link speed of communication links 500 _(A-D) and 500_(C-D) when compared to the link speed of communication link 500 _(A-C).

VI. Filtering

FIG. 17 is a flowchart illustrating an exemplary process 1700 forfiltering captured network traffic according to one or more criteria bya network captured traffic distribution device included in a stackedtopology of network captured traffic distribution devices. Process 1700may be executed by, for example, any of the devices and/or systemsdisclosed herein.

In step 1705, instructions to filter received captured network trafficmay be received by, for example, a network captured traffic distributiondevice included in a stacked topology of network captured trafficdistribution devices, such as network captured traffic distributiondevice 100. The instructions may be received from, for example, a userand/or administrator of the captured network distribution device, suchas user/administrator 655 via, for example, a GUI such as GUIs 300-302as discussed above with regard to FIGS. 3A-3C and/or a management port,such as management port 140. The instructions may also be received as,for example, exchanged configuration information from a network capturedtraffic distribution device included in the stacked topology. Theinstructions of step 1705 may also be received by a processor, likeprocessor 170, from, for example, a memory, such as memory 180.

The received instructions may indicate that received captured networktraffic is to be filtered according to a criterion or combination ofcriteria. Exemplary criterion include, but are not limited to, an originof the captured network traffic, a target destination of the capturednetwork traffic, a source of the captured network traffic, a type thecaptured network traffic, a protocol used to encode the captured networktraffic, a size of one or more data packets included in the capturednetwork traffic, a speed at which the captured network traffic isreceived, and an operating condition within the stacked topology, areceiving network captured traffic distribution device, and/or a targetdestination.

In some embodiments, filtration instructions may enable the filtering ofcaptured network traffic based on an amount of available capacityassociated with the stacked topology, a communication link, a receivingnetwork captured traffic distribution device, a target destination, acommunication device coupled to the stacked topology and/or an externaldevice coupled to the stacked topology. Indicators of available capacityinclude a maximum transmission or intake speed for captured traffic anda level of congestion associated with the stacked topology, acommunication link, a receiving network captured traffic distributiondevice, and/or a target destination.

In one embodiment, filtration instructions may be specific to one ormore characteristics of the captured network traffic such that, forexample, all captured traffic received from a source or via a particularbidirectional port included in the network captured traffic distributiondevice is filtered.

In yet another embodiment, filtration instructions may enable thefiltering of captured network traffic based on a target destinationassociated with the captured network traffic. Exemplary targetdestinations include a network captured traffic distribution deviceincluded in the stacked topology, a monitoring device, a protocolanalyzer, a flight recorder, an intrusion detection system, a mediaanalyzer, a signaling analyzer, a web analyzer, a database analyzer, avoice signaling analyzer, an IPTV analyzer, an application analyzer, avoice analyzer, and a forensic analyzer.

Next, in step 1710, captured network traffic may be received by, forexample, the network captured traffic distribution device, according to,for example, any of the methods described herein. Then, in step 1715, itmay be determined whether the captured network traffic was received viaan inline traffic capture point, such as inline traffic capture point665 and/or a mirror port, such as mirror port 660. When the capturednetwork traffic is received via an inline capture point, the receivednetwork captured traffic may be echoed to a bidirectional port, such asbidirectional port 110, resident on the network captured trafficdistribution device (step 1720). Whether the captured network traffic isreceived via an inline capture point or a mirror port, the receivedcaptured traffic may be filtered according to, for example, theinstructions received in step 1705 (step 1725).

Then, in step 1730, a target destination for the received capturednetwork traffic may be determined according to, for example, process1400 and/or 1500 as discussed above with regard to FIGS. 14 and 15,respectively. The filtered captured network traffic may then betransmitted toward the target destination determined via, for example,step 1730 (step 1735). Following step 1735, process 1700 may end.

FIG. 18 is a flowchart illustrating an exemplary process 1800 forfiltering and/or aggregating received captured network traffic by anetwork captured traffic distribution device included in a stackedtopology of network captured traffic distribution devices. Process 1800may be executed by, for example, any of the devices and/or systemsdisclosed herein.

In step 1805, captured network traffic may be received by, a networkcaptured traffic distribution device included in a stacked topology ofnetwork captured traffic distribution devices, like network capturedtraffic distribution device 100. Then, in step 1810, it may bedetermined whether the captured network traffic was received via aninline traffic capture point such as inline traffic capture point 665and/or a mirror port, such as mirror port 660. When the captured networktraffic is received via an inline capture point, the received networkcaptured traffic may be echoed to another bidirectional port, such asbidirectional port 110, resident on network captured trafficdistribution device (step 1815).

Whether the captured network traffic is received via an inline trafficcapture point or a mirror port, a plurality of filters may be applied tothe received captured network traffic using, for example, process 1700(step 1820) and thereby generating a plurality of filtered traffic sets(step 1825). Then, in step 1830, a target destination of each of thefiltered traffic sets included in the plurality of filtered traffic setsmay be determined via, for example, process 1400 and/or 1500 asdiscussed above with regard to FIGS. 14 and 15.

Next, in step 1835, filtered traffic sets with the same targetdestination may be aggregated together. Further details regarding theaggregation of step 1835 are provided below with regard to FIG. 19 andprocess 1900. Finally, in step 1840, the aggregated filtered trafficsets may be transmitted toward the determined target destination. Step1840 may be performed via one or more network captured trafficdistribution devices included in the stacked topology of networkcaptured traffic distribution devices. Following step 1840, process 1800may end.

VII. Aggregation

FIG. 19 illustrates an exemplary process 1900 for aggregating sets ofcaptured network traffic received by a network captured trafficdistribution device included in a stacked topology of network capturedtraffic distribution devices. Process 1900 may be executed by, forexample, any of the devices and/or systems disclosed herein.

In step 1905, a first set of captured network traffic may be receivedby, for example, a network captured traffic distribution device includedin a stacked topology of network captured traffic distribution devices,such as network captured traffic distribution device 100. Then, in step1910, it may be determined whether the captured network traffic wasreceived via an inline traffic capture point, such as inline trafficcapture point 665 and/or a mirror port, such as mirror port 660. Whenthe captured network traffic is received via an inline capture point,the received captured network traffic may be echoed to anotherbidirectional port resident on the network captured traffic distributiondevice, such as bidirectional port 110, for eventual transmission to,for example, a communication or external device.

Whether the first set of captured traffic is received via an inlinetraffic capture point or a mirror port, in step 1920, a targetdestination for the first set of captured network traffic may bedetermined via, for example, processes 1400 and/or 1500 as discussedabove with regard to FIGS. 14 and 15. Next, in step 1925, a route fromthe network captured traffic distribution device, through the stackedtopology of network captured traffic distribution devices, to adetermined target destination may be determined.

Then, in step 1930 a second set of captured network traffic may bereceived by, for example, the network captured traffic distributiondevice. On some occasions, following step 1930, steps 1910 and 1915 mayrepeat themselves. Then, in step 1935, a target destination of thesecond set of captured network traffic may be determined. Again, thisdetermination may be made via, for example, processes 1400 and/or 1500as discussed above with regard to FIGS. 14 and 15. Next, in step 1940,it may be determined whether the target destination of the second set oftraffic is similar to the target destination of the first set oftraffic. When the target destination for the second set of traffic isnot similar to the target destination of the first set of traffic, thetarget destination for the second set of captured network traffic may bedetermined (step 1945). The first and second sets of captured networktraffic may then be transmitted toward their respective targetdestinations (step 1955).

When the target destination of the second set of captured networktraffic is similar to, or the same as, the target destination of thefirst set of captured network traffic, the first and second set ofcaptured network traffic may be aggregated together (step 1950). Then,the aggregated first and second sets of captured network traffic may betransmitted toward the determined target destination (step 1955).Following step 1955, process 1900 may end.

In some embodiments, the first and second sets of captured networktraffic may be received from the same source, while in otherembodiments, the first set of captured network traffic may be receivedfrom a first source and the second set of captured network traffic maybe received from a second source. In some cases, the first and secondsources may be positioned in geographically disperse positions. Forexample, a first source may be located on the first floor of an officebuilding, while the second source of captured network traffic may belocated on the second floor of the office building, an adjacent officebuilding, and/or an office building miles away from the first source. Insome cases, the first and second sources may not be located within thesame city, region, or country as one another.

FIG. 20 is a flowchart illustrating an exemplary process 2000 foraggregating sets of captured network traffic received by a networkcaptured traffic distribution device included in a stacked topology ofnetwork captured traffic distribution devices. Process 2000 may beexecuted by, for example, any of the devices and/or systems disclosedherein.

In step 2005, a plurality of sets of captured network traffic may bereceived by, for example, a network captured traffic distribution devicecoupled to a plurality of network captured traffic distribution devicesarranged in a stacked topology, such as network captured trafficdistribution device 100. The plurality of sets of captured networktraffic may be received from a plurality of geographically dispersedsources.

Then, in step 2010, it may be determined whether the captured networktraffic was received via an inline traffic capture point, such as inlinetraffic capture point 665 and/or a mirror port, such as mirror port 660.When the captured network traffic is received via an inline capturepoint, the received network captured traffic may be echoed to anotherbidirectional port, such as bidirectional port 110, resident on networkcaptured traffic distribution device (step 2015).

Whether one or more of the plurality of sets of captured network trafficis received via an inline traffic capture point or a mirror port, instep 1220 a target destination for each set of received captured networktraffic may be determined. Step 2020 may be executed using, for example,processes 1400 and/or 1500 as discussed above with regard to FIGS. 14and 15. Next, in step 2025, it may be determined whether any of thereceived sets of captured network traffic have the same targetdestination. Then, in step 2030, sets of captured network traffic withthe same target destination may be aggregated together and transmittedtoward the target destination (step 2035).

VIII. Monitoring Stacked Topology

FIG. 21A is a flowchart depicting an exemplary process 2100 formonitoring a stacked topology of network captured traffic distributiondevices and/or a device communicatively coupled to the stacked topology.Process 2100 may be executed by, for example, any of the devices and/orsystems disclosed herein.

In step 2105, a status of a stacked topology and/or a device, such as anetwork captured traffic distribution device included in the stackedtopology, a network communicatively coupled to the stacked topology, anetwork device communicatively coupled to the network, a communicationdevice communicatively coupled to the stacked topology, a communicationlink included in the stacked topology, and/or an external devicecommunicatively coupled to the stacked topology may be monitored. Step2105 may be executed by, for example, one or more network capturedtraffic distribution devices included in the stacked topology, such asnetwork captured traffic distribution device 100.

The monitored status of step 2105 may relate to, for example, a level ofcongestion present at the stacked topology and/or a monitored device, anoperational status of the stacked topology and/or a monitored device,and any changes in the make-up of the stacked topology, including, butnot limited to, an addition or subtraction of a network captured trafficdistribution device to/from the stacked topology or a change in afunction associated with a port. In some cases, the monitored status ofstep 1205 may also relate to an intrusion, or the detection of anintrusion, by an unauthorized user to, for example, the stacked topologyor a device coupled to the stacked topology. In some embodiments, themonitored status may also relate to the detection of unauthorizedactivity occurring on the stacked topology or a device coupled to thestacked topology.

Then, in step 2110, a change in the status of the stacked topologyand/or a monitored device may be detected by, for example, the networkcaptured traffic distribution device. Exemplary detected changes includea failure, a security breach, a loss of power, a level of congestionthat exceeds a threshold amount, the addition of a new network capturedtraffic distribution device to the stacked topology, the removal of anetwork captured traffic distribution device from the stacked topology,and a change in the status of a network device included coupled to thestacked topology.

Then, in step 2115, the configuration information included in thenetwork captured traffic distribution device may be adjustedresponsively to the detected change. For example, when a failure of anetwork captured traffic distribution device included in the stackedtopology is detected, the network captured traffic distribution devicemay update its configuration information to reflect the change and/orcalculate alternative routes from the network captured trafficdistribution device, through the stacked topology, to targetdestinations that do not include the failed network captured trafficdistribution device.

Next, in step 2120, a detected change and/or adjusted configurationinformation may be transmitted to one or more additional networkcaptured traffic distribution devices included in the stacked topology.On some occasions, step 2120 may be selectively executed such that onlynetwork captured traffic distribution devices that may be affected bythe detected change and/or adjusted configuration information may havethe detected change and/or adjusted configuration informationtransmitted to them. On other occasions, a detected change and/oradjusted configuration information may be transmitted from the networkcaptured traffic distribution device to all network captured trafficdistribution devices present in the stacked topology and/or devicescoupled to the stacked topology.

In one embodiment, step 2120 may also include transmission of a messageindicating the detected change and/or adjusted configuration informationto a network captured traffic distribution device included in thestacked topology and/or a device coupled to the stacked topology. Themessage may be designed and/or transmitted such that it is transmittedto each network captured traffic distribution device or device only oncethus resolving a cyclical or repeated sending of detected changes and/oradjusted configuration information throughout the stacked topology.

Next, in step 2125, the transmitted detected change and/or adjustedconfiguration information may be received at one or more additionalnetwork captured traffic distribution devices. Then, in step 2130, theconfiguration information of the additional network captured trafficdistribution devices may be adjusted to incorporate the receiveddetected change and/or adjusted confirmation information. Following step2130, process 2100 may end.

FIG. 21B illustrates an exemplary process 2101 for updatingconfiguration information associated with one or more network capturedtraffic distribution devices included in the stacked topology. Process2100 may be executed by, for example, any of the devices and/or systemsdisclosed herein.

In step 2150, a traffic flow of captured data packets may be receivedby, for example, a network captured traffic distribution device includedin a stacked topology, like network captured traffic distribution device100. Then, in step 2155, a target destination of a captured data packetincluded in the received traffic flow of captured data packets may bedetermined. Next, step 2160, a plurality of routes through the stackedtopology from the network captured traffic distribution device to thetarget destination may be determined. In some cases, step 2160 may beperformed according to processes 1400 and/or 1500 as described abovewith reference to FIGS. 14 and 15.

In step 2165, a change in the status of the stacked topology and/or adevice communicatively coupled to the stacked topology may be detectedaccording to, for example, process 2100, as discussed above, withreference to FIG. 21A. Following step 2165, the plurality of routesdetermined in step 2160 may be updated to incorporate the detectedchange (step 2170). For example, in the case of a newly added networkcaptured traffic distribution device, one or more routes may be updatedto include, for example, the addition of a network captured trafficdistribution device to the stacked topology.

Next, in step 2175, each of the updated routes may be analyzed accordingto one or more criteria. The analysis of step 2175 may be similar to theanalysis of step 1430 as discussed above with regard to FIG. 14. Then,in step 2180, an optimum route may be selected based upon the analysis.Step 2180 may be similar to, for example, step 1460 discussed above withregard to FIG. 14. Finally, in step 2185, the captured data packet maybe transmitted toward the target destination via the selected optimumroute. Following step 2185, process 2101 may end.

IX. Exchange of Configuration Information

FIG. 22 illustrates an exemplary process 2200 for exchangingconfiguration information between two or more network captured trafficdistribution devices arranged in a stacked topology. Process 2200 may beexecuted by, for example, any of the devices and/or systems disclosedherein.

In step 2205, a first network captured traffic distribution device, likenetwork captured traffic distribution device 100, may be communicativelycoupled to a stacked topology of network captured traffic distributiondevices via a coupling with a second network captured trafficdistribution device included in the stacked topology. In someembodiments, step 2205 may be executed according to process 200 asdiscussed above with regard to FIG. 2. Some or all of the networkcaptured traffic distribution devices present in the stacked topologymay be associated with configuration information. Exemplaryconfiguration information relates to one or more of determining a targetdestination for received captured traffic, pre-calculating a route forthe transmission of received captured traffic from a receiving networkcaptured traffic distribution device, through the stacked topology, to atarget destination, determining an optimum route for the transmission ofreceived captured network traffic from the network captured trafficdistribution device through, the stacked topology, to a targetdestination. On some occasions, configuration information may alsorelate to evaluating the current operating conditions of the stackedtopology.

In one embodiment, the configuration information may relate to groomingreceived captured network traffic according to one or more criteria,load balancing a distribution of received captured network trafficthrough the network captured traffic distribution device and/or thestacked topology, removing unwanted information from one or more datapackets included in the received captured network traffic, truncatingone or more data packets included in the received captured networktraffic, and load spreading a distribution of received captured networktraffic through the stacked topology. Configuration information relatingto grooming the received captured network traffic may also relate tofiltering the received captured network traffic according to one or morecriterion, aggregating one or more sets of captured network traffictransmitted through the stacked topology, altering the content of thereceived captured network traffic, adding information to one or moredata packets included in the received captured network traffic, andsubtracting information from one or more data packets included in thereceived captured network traffic.

On some occasions, the communicative coupling of step 2205 may includephysically coupling the first network captured traffic distributiondevice to the stacked topology via a physical communication link suchas, for example, an Ethernet cable, an optical fiber cable, and/or acopper cable. On some occasions, the communicative coupling of the firstnetwork captured traffic distribution device to the stacked topology mayinclude wirelessly coupling the first network captured trafficdistribution device to the stacked topology via a wireless communicationlink.

Then, in step 2210, the first network captured traffic distributiondevice may recognize the second network captured traffic distributiondevice included in the stacked topology. On some occasions, step 2210may include the transmission of a message from the first networkcaptured traffic distribution device to the second network capturedtraffic distribution device and the receipt of an acknowledgementmessage from a second network captured traffic distribution device bythe first network captured traffic distribution device responsively tothe transmitted message.

Next, in step 2215, a portion of the configuration informationassociated with the first network captured traffic distribution devicesmay be automatically exchanged with the second network captured trafficdistribution device and/or a portion of the configuration informationassociated with the second network captured traffic distribution devicesmay be automatically exchanged with the first network captured trafficdistribution device. In one embodiment, the automatic exchange ofconfiguration information of step 2215 may include the transmission of arequest from the first to the second network captured trafficdistribution device for a portion of the configuration informationassociated with the second network captured traffic distribution device.The first network captured traffic distribution device may then receivethe requested configuration information responsively to the transmittedrequest.

In step 2220, the configuration information of the first and/or secondnetwork captured traffic distribution devices may be automaticallyupdated responsively to some or all of the exchanged configurationinformation. Optionally, in step 2225, one or more operations may beexecuted by the first and/or second network captured trafficdistribution devices responsively to the exchanged configurationinformation. For example, when determining an optimum route through astacked topology, the first network captured traffic distribution devicemay incorporate configuration information regarding the link speed ofvarious links present in the stacked topology received from the secondnetwork captured traffic distribution device into the calculation of anoptimum route through the stacked topology. Following step 2225, process2200 may end.

In the preceding discussion various embodiments of the present inventionwere discussed as being implemented with the aid of computer-implementedprocesses or methods (a.k.a. programs or routines). Such programs may berendered in any computer-readable language and, in general, are meant toencompass any series of logical steps performed in a sequence toaccomplish the stated purpose. Any part of the foregoing descriptionthat was presented in terms of algorithms and/or symbolicrepresentations of operations on data within a computer memory should beunderstood as steps requiring physical manipulations of physicalquantities (usually represented in the form of electrical or magneticsignals) within computer-readable storage devices. Accordingly,throughout the preceding description of the present invention, termssuch as “processing”, “computing”, “calculating”, “determining”,“displaying” or the like, should be understood as referring to theactions and processes of an appropriately programmed computer processor,or similar electronic device, that manipulates and transforms datarepresented as physical (electronic) quantities within the computerprocessor's registers and any associated memories or other storagedevices into other data similarly represented as physical quantitieswithin those memories or registers or other such information storagedevices. The programs comprise computer-executable instructions storedon one or more such computer-readable storage mediums accessible to thecomputer processor, for example any type of disk including hard disks,floppy disks, optical disks, compact disk read only memories (CD-ROMs),and magnetic-optical disks, read-only memories (ROMs), random accessmemories (RAMs), erasable programmable read only memories (EPROMs),electrically erasable programmable read only memories (EEPROMs), flashmemories, other forms of electrical, magnetic or optical storage mediaaccessible to the computer processor.

1. A method comprising: receiving a first set of captured networktraffic at a network captured traffic distribution devicecommunicatively coupled to a plurality of network captured networktraffic distribution devices arranged in a stacked topology;determining, by the network captured network traffic distributiondevice, a target destination of the first set of captured networktraffic; determining, by the network captured network trafficdistribution device, a route for the transmission of the first set ofcaptured network traffic from the network captured network trafficdistribution device, through the stacked topology, to the determinedtarget destination; receiving a second set of captured network trafficat the network captured network traffic distribution device;determining, by the network captured network traffic distributiondevice, a target destination of the second set of captured networktraffic; determining, by the network captured network trafficdistribution device, whether the first and second sets of capturednetwork traffic have the same target destination; aggregating, by thenetwork captured network traffic distribution device, the first andsecond sets of captured network traffic based on the determination thatthe first and second sets of captured network traffic have the sametarget destination; and transmitting, by the network captured networktraffic distribution device, the aggregated first and second sets ofcaptured network traffic toward the target destination via thedetermined route.
 2. The method of claim 1, wherein the first set ofcaptured network traffic is received from a first source and the secondset of captured network traffic is received from a second source.
 3. Themethod of claim 2, wherein the first and second sources are positionedin geographically disperse locations.
 4. The method of claim 1, whereinthe target destination is at least one of a monitoring device, aprotocol analyzer, a flight recorder, an intrusion detection system, amedia analyzer, a signaling analyzer, a web analyzer, a databaseanalyzer, a voice signaling analyzer, an Internet protocol television(IPTV) analyzer, an application analyzer, a voice analyzer, and aforensic analyzer.
 5. The method of claim 1, wherein the receivednetwork traffic is received via at least one of a traffic capture pointlocated between two communication devices and a mirror port of a networkswitch.
 6. A method comprising: receiving a plurality of sets ofcaptured network traffic from a plurality of geographically dispersesources at a network captured traffic distribution devicecommunicatively coupled to a plurality of network captured networktraffic distribution devices arranged in a stacked topology;determining, by the network captured network traffic distributiondevice, a target destination of each set of captured network traffic;determining, by the network captured network traffic distributiondevice, whether any of the sets of captured network traffic have thesame target destination; aggregating, by the network captured networktraffic distribution device, the sets of captured network traffic withthe same target destination based on the determination; andtransmitting, by the network captured network traffic distributiondevice, the aggregated captured network traffic toward the targetdestination.
 7. The method of claim 6, wherein the target destination isat least one of a monitoring device, a protocol analyzer, a flightrecorder, an intrusion detection system, a media analyzer, a signalinganalyzer, a web analyzer, a database analyzer, a voice signalinganalyzer, an Internet protocol television (IPTV) analyzer, anapplication analyzer, a voice analyzer, and a forensic analyzer.
 8. Themethod of claim 6, wherein a source of the received network traffic isat least one of a traffic capture device positioned at a traffic capturepoint located between two communication devices and a mirror port of anetwork switch.
 9. A system comprising: a source of captured networktraffic, wherein the source performs at least one of capturing networktraffic transmitted between two devices and receiving captured trafficvia a mirror port of a network switch; a plurality of stacked networkcaptured traffic distribution devices arranged in a stacked topologysuch that each network captured traffic distribution device iscommunicatively coupled via a communication link with at least oneadditional stacked network captured traffic distribution device and eachstacked network captured traffic distribution device automaticallyexchanges configuration information with at least some of the pluralitystacked network captured traffic distribution devices in the stackedtopology and aggregates captured network traffic with the same targetdestination, wherein at least one network captured traffic distributiondevice of the plurality of network captured traffic distribution devicesis configured to receive captured network traffic from the source, andat least one network captured traffic distribution device of theplurality of network captured traffic distribution devices is configuredto transmit received captured traffic to an external device via acommunication link; and the external device for receiving capturednetwork traffic from at least one of the stacked network capturedtraffic distribution devices.
 10. The system of claim 9, wherein each ofthe plurality of stacked network captured traffic distribution deviceshas a unique IP address, the system further comprising: a web browserenabled to communicate with each stacked network captured trafficdistribution device via the unique IP address, wherein the communicationincludes an exchange of aggregation instructions that enable a receivingnetwork captured traffic distribution device to aggregate sets ofcaptured network traffic with the same target destination.
 11. Thesystem of claim 9, wherein the stacked topology is arranged as at leastone of a ring topology, a mesh topology, a star topology, a topology ofsingle links, a topology of multiple links, a topology including one ormore redundant links, and some combination thereof.
 12. The system ofclaim 9, wherein the communication link is at least one of an Ethernetcable, a coaxial cable, a fiber optic cable, and a wireless link. 13.The system of claim 9, wherein communication along the communicationlink is bi-directional.
 14. The system of claim 9, wherein at least oneof the network captured traffic distribution devices is furtherconfigured to perform at least one of determining a target destinationfor received captured network traffic, pre-calculating at least oneroute for the transmission of received captured network traffic from anorigin through the stacked topology to a target destination, determiningan optimum route for the transmission of captured network traffic froman origin through the stacked topology to a target destination, loadbalancing a distribution of received captured traffic through thestacked topology, load spreading a distribution of received capturedtraffic through the stacked topology, grooming received captured networktraffic, filtering the received network traffic transmitted through thestacked topology according to a criterion, and evaluating a currentoperating condition of the stacked topology.
 15. The system of claim 9,further comprising: a plurality of external devices, wherein eachexternal device is configured to perform at least one of a monitoring acategory of captured network traffic and analyzing a category ofcaptured network traffic.
 16. The system of claim 15, wherein thenetwork captured traffic distribution device is further configured totailor the aggregation of received captured traffic for each externaldevice based on one or more categories of captured network traffic theexternal device is configured to monitor or analyze.
 17. The system ofclaim 9, wherein the external device is at least one of a communicationdevice, a protocol analyzer, a flight recorder, an intrusion detectionsystem, a media analyzer, a signaling analyzer, a web analyzer, adatabase analyzer, a voice signaling analyzer, an Internet protocoltelevision (IPTV) analyzer, an application analyzer, a voice analyzer, atelecommunications analyzer, and a forensic analyzer.
 18. The system ofclaim 9, wherein at least one of the communication devices, the stackednetwork captured traffic distribution devices, and external deviceoperate at locations that are geographically disperse from one another.19. The system of claim 9, wherein the system is compatible with acarrier Ethernet system, a network forensic security system, a carriervoice over Internet provider (VoIP) system, an Internet protocoltelevision (IPTV) system, a network security system, a network intrusiondetection system, and a telecommunications system.